Request without origin continues as non CORS